CVE-2025-34224 json
Vasion Print (formerly PrinterLogic) Unauthenticated Device Modification
published last yr. modified 22d ago also EUVD-2025-31626
- cvss
- 9.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 62%
- public exploits
- 0
- none known
Summary
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose a set of PHP scripts under the `console_release` directory without requiring authentication. An unauthenticated remote attacker can invoke these endpoints to re‑configure networked printers, add or delete RFID badge devices, or otherwise modify device settings. This vulnerability has been identified by the vendor as: V-2024-029 — No Authentication to Modify Devices.
Patch / fix
- Vasion Print Virtual Appliance Host 22.0.1049
- Vasion Print Application 20.0.2786
Is CVE-2025-34224 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- last yr.
Exploit prediction
0.97% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- pierrekim.github.io https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-lack-of-auth-manage-printers referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 10.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| CNA | 4.0 | 10.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Affected products
- Vasion Print Virtual Appliance Host
- Vasion Print Application
Classification
- Weakness
-
- CWE-306 Missing Authentication for Critical Functionality
References
-
help.printerlogic.com
/va/Print/Security/Security-Bulletins.htm
vendor-advisory, patch
-
help.printerlogic.com
/saas/Print/Security/Security-Bulletins.htm
vendor-advisory, patch
-
pierrekim.github.io
/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-lack-of-auth-manage-printers
technical-description, exploit, third-party-advisory
-
vulncheck.com
/advisories/vasion-print-printerlogic-unauth-device-modification
third-party-advisory
Sources
- CVE List CVE-2025-34224
- NVD CVE-2025-34224
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.